A cyberattack waged against Seoul this year has put Web security firms on the trail of a malicious code first spotted in 2007 that
seems to be directed at spying on US forces in South Korea and the South’s forces that officials say have been traced back to Pyongyang

By Yonkyung Lee and Martha Mendoza / AP, SEOUL and SAN JOSE, California

Illustration: Mountain People

The hackers who knocked out tens of thousands of South Korean computers simultaneously this year are out to do far more than erase hard drives. They are trying to steal South Korean and US military secrets with a malicious set of codes that they have been sending through the Internet for years, cybersecurity firms say.

The identities of the hackers, and the value of any information they have acquired, are not known to US and South Korean researchers who have studied line after line of computer code. However, they do not dispute South Korean claims that North Korea is responsible and other experts say the links to military spying add fuel to Seoul’s allegations.

Researchers at Santa Clara, California-based McAfee Labs said the malware was designed to find and upload information referring to US forces in South Korea, joint exercises or even the word “secret.” McAfee said versions of the malware have infected many Web sites in an ongoing attack that it calls Operation Troy because the code is peppered with references to the ancient city. McAfee said that in 2009, malware was implanted into a social media Web site used by military personnel in South Korea.

“This goes deeper than anyone had understood to date and it’s not just attacks: It’s military espionage,” said Ryan Sherstobitoff, a senior threat researcher at McAfee who gave The Associated Press a report that the company is releasing later this week.

He analyzed code samples shared by US government partners and private customers.

McAfee found versions of the keyword-searching malware dating to 2009. South Korean cybersecurity researcher Simon Choi found versions of the code as early as 2007, with keyword-searching capabilities added in 2008. It was made by the same people who have also launched cyberattacks in South Korea over the past several years, Choi said.

Versions of the code may still be trying to glean military secrets from infected computers. Sherstobitoff said the same coded fingerprints were found on an attack on June 25 — the anniversary of the start of the 1950 to 1953 Korean War — in which Web sites for South Korean President Park Geun-hye and South Korean Prime Minister Jung Hong-won were attacked. A day later, the Pentagon said it was investigating reports that personal information about thousands of US troops in South Korea had been posted online.

Sherstobitoff began his investigation after the March 20 cyberattack, known as the Dark Seoul Incident. It wiped clean tens of thousands of hard drives, including those belonging to three television networks and three banks in South Korea, disabling ATMs and other bank services. South Korea says no military computers were affected by Dark Seoul.

The code used in the shutdown is different from that used to hunt for military secrets, but they share so many characteristics that Sherstobitoff and Choi believe they were made by the same people.

Sherstobitoff said those responsible for the spying had infected computers by “spear phishing” — targeted attacks that trick users into giving up sensitive information by posing as a trusted entity. The hackers hijacked about a dozen obscure Korean-language religious, social and shopping Web sites to pull secrets from infected computers without being detected.

The McAfee expert said the hackers have targeted government networks with military information for at least four years, using code that automatically searched infected computers for dozens of military terms in Korean, including “US Army,” “secret,” “Joint Chiefs of Staff” and “Operation Key Resolve,” an annual military exercise held by US Forces Korea and the South Korean military.